{ "id": "4d778910-f43e-4eb6-91d3-43039638799e", "created_at": "2026-04-06T01:32:05.545361Z", "updated_at": "2026-04-10T13:12:47.273379Z", "deleted_at": null, "sha1_hash": "713484ec70aabe502b20f1ddb4e80fb48e05fbb1", "title": "Russian National Convicted of Charges Relating to Kelihos Botnet", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 34537, "plain_text": "Russian National Convicted of Charges Relating to Kelihos Botnet\r\nPublished: 2021-06-16 · Archived: 2026-04-06 01:08:44 UTC\r\nA federal jury in Connecticut convicted a Russian national on Tuesday for operating a “crypting” service used to\r\nconceal “Kelihos” malware from antivirus software, enabling hackers to systematically infect victim computers\r\naround the world with malicious software, including ransomware.\r\nAccording to court documents and evidence introduced at trial, Oleg Koshkin, 41, formerly of Estonia, operated\r\nthe websites “Crypt4U.com,” “fud.bz” and others. The websites promised to render malicious software fully\r\nundetectable by nearly every major provider of antivirus software. Koshkin and his co-conspirators claimed that\r\ntheir services could be used for malware such as botnets, remote-access trojans, keyloggers, credential stealers and\r\ncryptocurrency miners.\r\n“The defendant designed and operated a service that was an essential tool for some of the world’s most destructive\r\ncybercriminals, including ransomware attackers,” said Acting Assistant Attorney General Nicholas L. McQuaid of\r\nthe Justice Department's Criminal Division. “The verdict should serve as a warning to those who provide\r\ninfrastructure to cybercriminals: the Criminal Division and our law enforcement partners consider you to be just\r\nas culpable as the hackers whose crimes you enable — and we will work tirelessly to bring you to justice.”\r\nIn particular, Koshkin worked with Peter Levashov, the operator of the Kelihos botnet, to develop a system that\r\nwould allow Levashov to crypt the Kelihos malware multiple times each day. Koshkin provided Levashov with a\r\ncustom, high-volume crypting service that enabled Levashov to distribute Kelihos through multiple criminal\r\naffiliates. Levashov used the Kelihos botnet to send spam, harvest account credentials, conduct denial of service\r\nattacks, and distribute ransomware and other malicious software. At the time it was dismantled by the FBI, the\r\nKelihos botnet was known to include at least 50,000 compromised computers around the world.\r\n“By operating a website that was intended to hide malware from antivirus programs, Koshkin provided a critical\r\nservice that enabled other cyber criminals to infect thousands of computers around the world,” said Acting U.S.\r\nAttorney Leonard C. Boyle for the District of Connecticut. “We will investigate and prosecute the individuals who\r\naid and abet cyber criminals as vigorously as we do the ones who actually hit the ‘send’ button on viruses and\r\nother malicious software.”\r\n“Koshkin and his associates knowingly provided crypting services designed to help malicious software bypass\r\nanti-virus software,” said Special Agent in Charge David Sundberg of the FBI’s New Haven Division. “The\r\ncriminal nature of the Crypt4U service was a clear threat to the confidentiality, integrity, and availability of\r\ncomputer systems everywhere. We at the FBI will never stop pursuing those like Koshkin for perpetrating cyber\r\ncrimes and threats to the public at large.”\r\nKoshkin was arrested in California in September 2019 and has been detained since his arrest. He faces a\r\nmaximum penalty of 15 years in prison and is scheduled to be sentenced on Sept. 20.\r\nhttps://www.justice.gov/opa/pr/russian-national-convicted-charges-relating-kelihos-botnet\r\nPage 1 of 2\n\nKoshkin’s co-defendant, Pavel Tsurkan, is charged with conspiring to cause damage to 10 or more protected\r\ncomputers, and aiding and abetting Levashov in causing damage to 10 or more protected computers.\r\nLevashov was arrested by the Spanish National Police in April 2017 and extradited to the United States. In\r\nSeptember 2018, he pleaded guilty to one count of causing intentional damage to a protected computer, one count\r\nof conspiracy, one count of wire fraud, and one count of aggravated identity theft.\r\nThe FBI’s New Haven Division investigated the case through its Connecticut Cyber Task Force.\r\nAssistant U.S. Attorney Edward Chang of District of Connecticut, and Senior Counsel Ryan K.J. Dickey of the\r\nCriminal Division’s Computer Crime and Intellectual Property Section are prosecuting the case with assistance\r\nfrom the Criminal Division’s Office of International Affairs. The Estonian Police and Border Guard Board also\r\nprovided significant assistance.\r\nThis case is part of the Department of Justice’s Ransomware and Digital Extortion Task Force, which was created\r\nto combat the growing number of ransomware and digital extortion attacks. As part of the Task Force, the\r\nCriminal Division, working with the U.S. Attorneys’ Offices, prioritizes the disruption, investigation, and\r\nprosecution of ransomware and digital extortion activity by tracking and dismantling the development and\r\ndeployment of malware, identifying the cybercriminals responsible, and holding those individuals accountable for\r\ntheir crimes. The department, through the Task Force, also strategically targets the ransomware criminal\r\necosystem as a whole and collaborates with domestic and foreign government agencies as well as private sector\r\npartners to combat this significant criminal threat.\r\nSource: https://www.justice.gov/opa/pr/russian-national-convicted-charges-relating-kelihos-botnet\r\nhttps://www.justice.gov/opa/pr/russian-national-convicted-charges-relating-kelihos-botnet\r\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia", "ETDA" ], "origins": [ "web" ], "references": [ "https://www.justice.gov/opa/pr/russian-national-convicted-charges-relating-kelihos-botnet" ], "report_names": [ "russian-national-convicted-charges-relating-kelihos-botnet" ], "threat_actors": [], "ts_created_at": 1775439125, "ts_updated_at": 1775826767, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/713484ec70aabe502b20f1ddb4e80fb48e05fbb1.pdf", "text": "https://archive.orkl.eu/713484ec70aabe502b20f1ddb4e80fb48e05fbb1.txt", "img": "https://archive.orkl.eu/713484ec70aabe502b20f1ddb4e80fb48e05fbb1.jpg" } }